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-- The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 



• Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment See 37 CFR 1 .704(b). 

Status 

1)13 Responsive to cx)mmunication(s) filed on 09 June 2005 , 
2a)IE This action is FINAL. 2b)n This action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) S Claim(s) 1-30 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) n Claim(s) is/are allowed. 

6) 13 Claim(s) 1-30 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10)0 The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held In abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or fomi PTO-152. 

Priority under 35 U.S.C. § 119 

12)0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or(f). 
a)n All b)n Some * c)^ None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

Response to Amendment 
This office action is in response to request for reconsideration filed on June 09, 2005. 
Original application contained Claims 1-30. The request for reconsideration filed on June 09, 
2005 have been entered and made of record. Presently Claims 1-30 are pending for 
consideration. 

Response to Arguments 

Applicant's arguments filed on June 09, 2005have been fully considered but they are not 
persuasive because of the following reasons: 

Regarding Claims 1-30 applicants argued that the cited prior art (CPA) [Chess et 
al. (U.S. Patent No. 5,485,575), and Chandnani U. S. Pub. 2002/0073330] does not teach, the 
subject matter as claimed. 

Regarding Claims 5,7-10, 15-20, and 25-30 appHcant argued that Chess only discuss a 
technique for identifying a virus and its characteristic by comparing a virus-infected computer 
program with the original, uninfected program; and Chess does not teach an interpreted 
language, a scripting language, or distribution of a computer virus in source code. 

Regarding Claims 1-4, 1 1-14, and 21-24, applicant also argued that lexical analysis is 
used to convert the data stream into a stream of tokens, but in Chandnani there is no other 
processing performed upon the tokens and no further representation of the tokens is produced, 
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and Chandnani does not teach or suggest generating a language-independent representation of 
the interpreted language source code to be scanned for a virus. 

This is not found persuasive. Chess clearly teaches system and method of automatic 
computer virus verification and removal method that involves obtaining generalized description 
of original and new data sample pairs with transformation finding invariant regions in samples 
for restoration. The method involves obtaining a set of "sample pairs", each consisting of 
transformed and corresponding untransformed data samples. One or more fragments of each 
original data sample within a transformed sample are located. This allows a generalized 
description to be obtained, applicable to each of the sample pairs of locations of fragments of 
each original data sample, and locations of new data regions added by the function-preserving 
transformation that applies to each of the sample pairs. New data regions added by the function- 
preserving transformation are matched across different samples to obtain a description of 
portions of the new data regions that are "invariant" across different samples. Within other, 
variable portions of the new data regions any data from an original data sample embedded there 
are located. A prescription for verifying with high confidence that any given data sample has 
resulted from an application of the function-preserving transformation is generated. A 
prescription for restoring a data sample that has been transformed by the function-preserving 
transformation to a form functionally equivalent to that prior to the transformation is also 
generated. Thus the system of Chess provides sufficiently detailed characterization of virus to 
allow anti- virus software to detect and remove virus (col.4 line 38 to col. 5 line 2 and col. 1 1 line 
39 to line 56). 
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The system of Chandnani on the other hand teaches a script language virus detection method in 
computer system, involves lexically analyzing data stream using prepared language description 
data and detection data. Detection data including test corresponding to a pattern match or a 
cyclical redundancy check is prepared. A data stream is analyzed lexically using the detection 
data and prepared language description data corresponding to a script language, to detect viral 
code (paragraph 0029, 0020, 0016, 0055, and 0064). 

As a result, cited prior art does implement and teach a system and method that relates to 
scanning computer code for viruses and for providing results pertaining to the viruses found by 
scanning of interpreted language viruses, such as scripting viruses. 

Applicants clearly have failed to explicitlv identify specific claim limitations, which 
would define a patentable distinction over prior arts. 

The examiner is not trying to teach the invention but is merely trying to interpret the claim 
language in its broadest and reasonable meaning. The examiner will not interpret to read 
narrowly the claim language to read exactly from the specification, but will interpret the claim 
language in the broadest reasonable interpretation in view of the specification. Therefore, the 
examiner asserts that cited prior art(s) does teach or suggest the subject matter recited in 
independent and dependent claims. Accordingly, rejections for claims 1-30 are respectfully 
maintained. 
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Claim Rejections - 35 USC§ 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

3. Claims 5, 7-10, 15-20, 25-30 are rejected under 35 U.S.C. 102(b) as being anticipated by 
Chess et al. (U.S. Patent 5,485,575). 

With respect to claim 5, Chess et al. disclose a method for generating a virus signature, the 
method comprising': 

Receiving a portion of interpreted language source code containing a computer virus 
(column 4, lines 38-39); 

Generating a language-independent representation of the computer virus (column 1 1, 
lines 55-58); and 

Storing the language- independent representation of the computer virus as a virus 
signature (column 11, lines 55-58). 

4. With respect to claim 7, Chess et al disclose a method wherein the virus signature is compiled 
in binary foi*mat (column 17, lines 15-20). 
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5. With respect to claim 8, Chess et al. disclose a method, wherein the language independent 
representation is a linearized string of key actions (column 12, lines 43-45). 

6. With respect to claim 9, Chess et al. disclose a method, wherein the virus signature includes 
input from a virus analyst (column 11, lines 39-56). 

7. With respect to claim 10, Chess et al. disclose a method, further comprising: 

Parsing the portion of interpreted language source code into tokens (column 11, lines 47- 
49); and 

Generating the language-independent representation of the computer virus using at least a 
portion of the tokens (column 11, lines 47-49, lines 55-58). 

8. With respect to claim 15, Chess et al. disclose a method for generating a virus signature from 
a portion of interpreted language source code including a computer virus, the method 
comprising: 

Receiving a portion of interpreted language source code containing a computer virus 
(column 4, lines 38-39), 

Parsing the portion of the interpreted language source code containing the computer virus 
into tokens to generate tokenized source code, wherein at least some of the tokens represent key 
actions (column 1 1 , lines 47-49); 

Extracting key actions from the tokenized source code (column 11, lines 47-49), 

Linearizing the key actions to generate an executing thread (column 12, lines 43-45); 

Determining the set of minimum key actions in the executing thread required to effect the 
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computer virus (column 1 1, lines 55-58); and 

Storing the set of minimum key actions as a virus signature (column 11, lines 55-58). 

9. With respect to claim 16, Chess et al. disclose a method, further comprising: 
Compiling the virus signature in binary format (column 17, lines 15-20). 

10. With respect to claim 17, Chess et al. disclose a method, further comprising; 

Compiling the virus signature with data input by a virus analyst (column 11, lines 39-56); 

and 

Storing the virus signature as part of a virus pattern file (column 17, line 20). 

1 1 . With respect to claim 1 8, Chess et al. disclose a method, wherein the virus pattern file 
further includes a dictionary of key actions (colunm 17, line 20; column 11, lines 55-58; Each 
signature consists of key actions.). 

12. With respect to claim 19, Chess et al. disclose a method, wherein the portion of the 
interpreted language source code is lexically parsed (column 13, line 9-10). 

13. With respect to claim 20, Chess et al. disclose a method, wherein the portion of the 
interpreted language source code is lexically and grammatically parsed (column 13, line 9-10; 
column 1 1, lines 60-64). 

14. With respect to claim 25, Chess et al. disclose a computer readable medium containing 
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program code (column 4, lines 5-7, 16-18) for generating a virus signature from a portion of 
interpreted language source code including a computer virus, the computer readable medium 
comprising instructions for: 

Receiving a portion of interpreted language source code containing a computer virus 
(column 4, lines 38-39); 

Parsing the portion of the interpreted language source code containing the computer virus 
into tokens to generate tokenized source code, wherein at least some of the tokens represent key 
actions (column 11, lines 47-49), 

Linearizing at least a portion of the key actions to generate an executing thread (column 
12, lines 43-45); 

Determining the set of minimum key actions in the executing thread required to effect the 
computer virus (column 11, lines 55-58); and 

Storing the set of minimum key actions as a virus signature (column 11, lines 55-58). 

15. With respect to claim 26, Chess et al disclose a computer readable medium, further 
comprising: 

Compiling the virus signature in binary format (column 17, lines 15-2%. 

16. With respect to claim 27, Chess et al. disclose a computer readable medium, further 
comprising: 

Compiling the virus signature with data input by a virus analyst (column 1 1, lines 39-56); 

and 
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Storing the virus signature as part of a virus pattern file (column 17, line 20). 

17. With respect to claim 28, Chess et al. disclose a computer readable medium, wherein the 
virus pattern file further includes a dictionary of key actions (column 17, line 20,. column 11, 
lines 55-58; Each signature consists of key actions.). 

18. With respect to claim 29, Chess et al. disclose a computer readable medium, wherein the 
portion of the interpreted language source code is lexically parsed (column 13, line 9-10). 

19. With respect to claim 30, Chess et al. disclose a computer readable medium, wherein the 
portion of the interpreted language source code is lexically and grammatically parsed (column 
13, line 9-10; column 11, lines 60-64). 

20. The following is a quotation of the appropriate pai'agraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 35 1 (a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

21. Claims 1-4, 1 1-14, 21-24 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Chandnani et al. (U.S. PubUcation 2002/0073330). 
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22. With respect to claim 1, Chandnani et al. disclose a method for identifying a computer 
virus in interpreted language source code, the method comprising: 

Receiving a portion of interpreted language source code (paragraph 0029, lines 4-5); 

Generating a language-independent representation of the portion of the interpreted 
language source code (Paragraph 0020, hnes 1-2); 

Comparing the language-independent representation with a virus signature (paragraph 
0064); and 

Determining if the language-independent representation matches the virus signature, 
whereby a match indicates a computer virus has been identified (paragraph 0064). 

23. With respect to claim 2, Chandnani et al. disclose a method, wherein the interpreted language 
source code is a scripting language source code (paragraph 0016, lines 1-2). 

24. With respect to claim 3, Chandnani et al. disclose a method, wherein the virus signature is a 
language-independent representation of an interpreted language source code computer virus 
(paragraph 0055). 

25. With respect to claim 4, Chandnani et al. disclose a method, wherein the portion of 
interpreted language source code and the virus signature are represented as a linearized string of 
key actions (paragraph 0055). 
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26. With respect to claim 1 1, Chandnani et al. disclose a method (paragraph 0029, line 2) for 
identifying a virus in interpreted language source code, the method confqjrising: 

Receiving a portion of interpreted language source code (paragraph 0029, lines 4-5); 

Parsing the portion of the interpreted language source code into tokens to generate a 
tokenized source code, wherein at least some of the tokens represent key actions (paragraph 
0020, lines 1-2)) 

Extracting selected key actions from the tokenized source code (paragraph 0020, lines 2- 

Linearizing the key actions to generate an executing thread (paragraph 0020, lines 3-5); 
Comparing the executing thread with a virus signature of a known virus (paragraph 
0064); and 

Determining whether the executing thread matches the virus signature (paragraph 0064). 

27. With respect to claim 21, Chandnani et al. disclose a computer readable medium (paragraph 
0066, lines 1-5) containing program code for identifying a computer virus in interpreted 
language source code, the computer readable medium comprising instructions for: 

Receiving a portion of interpreted language source code (paragraph 0029, lines 4-5); 

Parsing the portion of the interpreted language source code into tokens to generate a 
tokenized source code, wherein at least some of the tokens represent key actions (paragraph 
0020, lines 1-2); 

Extracting selected key actions from the tokenized source code (paragraph 0020, lines 2- 

3). 



Application/Control Number: 10/042,804 Page 12 

Art Unit: 2131 

Linearizing the key actions to generate an executing thread (paragraph 0020, lines 3-5); 
Conparing the executing thread with a virus signature of a known virus (paragraph 
0064); and 

Determining whether the executing thread matches the virus signature (paragraph 0064). 

28. With respect to claims 12 and 22, Chandnani et al. disclose a method and medium, further 
comprising: 

Outputting the identification of the known virus (paragraph 0055, lines 9-13; paragraph 
0063, lines 12-15). 

29. With respect to claims 13 and 23, Chandnani et al disclose a method and medium, wherein 
the portion of the interpreted language source code is lexically parsed (paragraph 0016, lines 8- 
10). 



30. With respect to claim 14 and 24, Chandnani et al. disclose a method and medium, wherein 
the portion of the interpreted language source code is lexically and grammatically parsed 

(paragraph 0017). 
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Claim Rejections - 35 USC § 103 

31. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

32. Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over Chess et al. (U.S. 
Patent 5,485,575) in view of Chandnani et al. (U.S. Publication 2002/0073330). 

33. Chess et al. and Chandnani et al. are analogous art because both are in the field of computer 
security. 

34. With respect to claim 6, Chess et al. disclose the limitations set forth in claim 5, upon which 
claim 6 is dependent. 

35. Chess et al. do not disclose a method wherein the interpreted language source code is a 
scripting language source code. 

Chandnani et al. disclose a method wherein the interpreted language source code is a scripting 
language source code (paragraph 0016, lines 1-2), 

36. It would have been obvious to one of ordinary skill in the ait to have combined the teachings 
of Chandnani et al. with the teachings of Chess et al. in order to prevent potentially terrible 
problems with a computer system or operating system (paragraph 0005). 
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Conclusion 

TfflS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1. 136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Syed Zia whose telephone number is 571-272-3798. The 
examiner can normally be reached on 9:00 to 5:00. 

If attempts to reach the examiner by telephone are unsuccessfiil, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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